Read More

Ms Poole added: “The council should have known that in the wrong hands, this type of sensitive information could cause substantial distress to staff.

“Businesses and organisations must understand they need to do everything they can to keep people’s personal information safe and that includes being extra vigilant during periods of change or uncertainty.”

The attack exploited the ‘Heartbleed’ software flaw, said an ICO statement, which added: "Despite well publicised warnings from the ICO and the media, the council failed to repair the vulnerability in a timely manner, leaving personal information at risk and breaking data protection law."

Gloucester City Council were hacked by a group claiming to be from Anonymous

The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Jon McGinty, managing director of Gloucester City Council, said: “The council is very disappointed with this decision by the Information Commissioner, and is considering its position whether to appeal.

“The council takes the security of its data very seriously and remains of the view that it did take swift and reasonable steps in 2014 to prevent a data breach as soon as it was alerted to the existence of this hacking vulnerability and the availability of a security patch.

"The Heartbleed vulnerability was a threat to businesses for some time before a patch was issued by software providers.

Read More

“There is insufficient evidence to show that the hacking event took place after the council became aware of the existence of the potential vulnerability.

"The council believes that the penalty issued by the ICO will have a serious and detrimental impact on its finances, and the services that we will be able to provide to the residents of Gloucester in the future.

"The council has invested more than £1million over the past 3 years to further improve its IT security and remains vigilant to the threats that all businesses face on a daily basis.

“The council did account for the risk of this potential fine in its accounts for 2016-17 but nevertheless its payment will only result in money being taken away from the people of Gloucester and given to Treasury.”

To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns